Artificial intelligence tools are fundamentally altering both the rate of vulnerability discovery and the risk profiles of detected security flaws, according to a recent report from the Google Threat Intelligence Group (GTIG). Analyzing security data from January 2025 through August 2026, the group observed that monthly vulnerability disclosures doubled over the course of 2026, driven largely by automated systems and changing discovery methodologies.
Exploitation Trends and N-Day Weaponization
While overall vulnerability disclosures peaked at 10,740 in August 2026, GTIG noted that raw volume figures can be inflated by automated CVE assignments, such as roughly 5,000 Linux kernel CVEs assigned without any observed zero-day exploitation. However, actual in-the-wild exploitation also surged, averaging 18 vulnerabilities per month in 2026 compared to 10.5 in 2025. Despite the rise, exploited vulnerabilities represented only 0.23% of total disclosures during the period.
Researchers attribute much of this growth to the weaponization of known flaws, or n-days, rather than brand-new zero-days. GTIG suggests threat actors are leveraging large language models and AI tools to rapidly analyze code differences between product versions, patch releases, and disclosure announcements to build functional exploits faster.
Distinct Risk Profiles of AI-Discovered Flaws
Vulnerabilities discovered by AI demonstrate a markedly different profile than traditional findings. GTIG rated 58% of AI-discovered flaws as medium-risk and 39% as low-risk, compared to 28% medium-risk and 69% low-risk for non-AI findings. Furthermore, half of all AI-identified flaws result in remote code execution, compared to just 26% of non-AI vulnerabilities, as AI tools excel at discovering complex memory corruption and logic flaws that standard static analysis tools miss.
The report highlights early evidence of threat actors targeting AI-discovered flaws shortly after disclosure. For instance, an unauthenticated OS command injection vulnerability in BeyondTrust software, identified autonomously by an AI agent, saw active exploitation by one threat cluster within four days of public disclosure, with five additional clusters joining within a week.
Vulnerabilities Within AI Infrastructure
The security of AI systems themselves is also facing increased scrutiny. GTIG recorded over 1,500 AI-related CVEs in the first eight months of 2026 alone, with approximately half impacting AI orchestration frameworks. While only a small fraction of these flaws—such as bugs in LiteLLM and Langflow—have seen confirmed exploitation in the wild, researchers expect overall discovery and exploitation rates across all software to continue rising in the near term.
AI-generated editorial illustration; not a documentary photograph.
Source: Google: AI Is Changing the Pace and Profile of Vulnerability Discovery
SIGNAL TITANS
Leave a Reply